Separate dependency caches by trust level

Description

Dependency caches are keyed on the lockfile hash. Builds of untrusted changes (external contributions, forks) cannot write to caches read by default-branch or release builds.

Rationale

A poisoned cache lets an attacker who can run one build insert packages into every following build, bypassing lockfile and registry controls.

Impact

Slightly lower cache hit rates.

Audit

1. Review cache configuration of pipelines.
2. Check cache keys include the lockfile hash and that untrusted builds cannot write to trusted caches.

Automated: every check must pass. Scanners report each check by its id.

postmortem

GitHub Actions cache keys and pull_request_target; other CI by hand

command: postmortem harden --json
control: CB-DEP-CI-004
coverage: partial

Remediation

1. Key caches on the lockfile hash.
2. Give untrusted builds read-only or separate caches.

References

• OWASP Top 10 CI/CD Security Risks OWASP, guide, accessed 2026-10-16

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-DEP-LOCK-003 Verify package integrity against recorded hashes

People and lifecycle